CVE-2026-72640

Name of the Vulnerable Software and Affected Versions Elastic Cloud on Kubernetes (ECK) operator (affected versions not specified)

Description The Elastic Cloud on Kubernetes (ECK) operator reads secret references from an annotation on managed secrets. It fails to validate if the recorded namespace in each reference is authorized for the resource being reconciled. This allows a user with limited permissions in their own namespace to write the annotation and trigger a reconcile, leveraging the operator's cluster-wide permissions to copy secret contents from any other namespace into a secret accessible to the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.